Project

General

Profile

Download (6.21 KB)

Bug #8686 ยป ipsec_filtermode.diff

Jim Pingle, 02/04/2021 01:15 PM

View differences:

src/etc/inc/filter.inc
97 97 
 * Specify the driver prefix to match (from the left)
98 98 
 * https://redmine.pfsense.org/issues/8685
99 99 
 */
100 
global $filter_interface_blacklist;
101 
$filter_interface_blacklist = array("ipsec");
100 
global $filter_interface_remove;
101 
$filter_interface_remove = array();
102 

  		




  
  103
  
    
if ($config['ipsec']['filtermode'] == 'if_ipsec') {

  		




  
  104
  
    
	$filter_interface_remove[] = 'enc';

  		




  
  105
  
    
} else {

  		




  
  106
  
    
	$filter_interface_remove[] = 'ipsec';

  		




  
  107
  
    
}

  		




  102
  108
  
    

  		




  103
  109
  
    
/*

  		




  104
  110
  
    
 * Fixed tracker values (used to group and track usage in GUI):

  		




  ......




  4700
  4706
  
    
}

  		




  4701
  4707
  
    

  		




  4702
  4708
  
    
function filter_get_interface_list() {

  		




  4703
  
  
    
	global $filter_interface_blacklist;

  		




  
  4709
  
    
	global $filter_interface_remove;

  		




  4704
  4710
  
    
	$iflist = create_interface_list();

  		




  4705
  4711
  
    
	$filter_ifs = array();

  		




  4706
  4712
  
    
	foreach ($iflist as $ifent => $ifname) {

  		




  4707
  4713
  
    
		$realifname = get_real_interface($ifent);

  		




  4708
  
  
    
		foreach ($filter_interface_blacklist as $ifbl) {

  		




  4709
  
  
    
			if (substr($realifname, 0, strlen($ifbl)) == $ifbl) {

  		




  
  4714
  
    
		foreach ($filter_interface_remove as $ifr) {

  		




  
  4715
  
    
			if (substr($realifname, 0, strlen($ifr)) == $ifr) {

  		




  4710
  4716
  
    
				continue 2;

  		




  4711
  4717
  
    
			}

  		




  4712
  4718
  
    
		}

  		












  

    
      src/etc/inc/globals.inc
    
  





  160
  160
  
    
	"net.inet.udp.checksum" => 1,

  		




  161
  161
  
    
	"net.inet.icmp.reply_from_interface" => 1,

  		




  162
  162
  
    
	"net.inet6.ip6.rfc6204w3" => 1,

  		




  163
  
  
    
	"net.enc.out.ipsec_bpf_mask" => "0x0001",

  		




  164
  
  
    
	"net.enc.out.ipsec_filter_mask" => "0x0001",

  		




  165
  
  
    
	"net.enc.in.ipsec_bpf_mask" => "0x0002",

  		




  166
  
  
    
	"net.enc.in.ipsec_filter_mask" => "0x0002",

  		




  167
  163
  
    
	"net.key.preferred_oldsa" => "0",

  		




  168
  164
  
    
	"net.inet.carp.senderr_demotion_factor" => 0, /* Do not demote CARP for interface send errors */

  		




  169
  165
  
    
	"net.pfsync.carp_demotion_factor" => 0, /* Do not demote CARP for pfsync errors */

  		




  ......




  322
  318
  
    
		'hmac-sha384' => 'HMAC-SHA384',

  		




  323
  319
  
    
		'hmac-sha512' => 'HMAC-SHA512 (most secure)');

  		




  324
  320
  
    

  		




  
  321
  
    
global $ipsec_filtermodes;

  		




  
  322
  
    
$ipsec_filtermodes = array(

  		




  
  323
  
    
	'enc' => 'Filter IPsec Tunnel and VTI on IPsec tab (enc0)',

  		




  
  324
  
    
	'if_ipsec' => 'Filter IPsec VTI on assigned interfaces, block all tunnel mode traffic'

  		




  
  325
  
    
);

  		




  
  326
  
    

  		




  
  327
  
    
global $ipsec_filter_sysctl;

  		




  
  328
  
    
$ipsec_filter_sysctl = array(

  		




  
  329
  
    
	'enc' => array(

  		




  
  330
  
    
		"net.inet.ipsec.filtertunnel"   => "0x0000",

  		




  
  331
  
    
		"net.inet6.ipsec6.filtertunnel" => "0x0000",

  		




  
  332
  
    
		"net.enc.out.ipsec_bpf_mask"    => "0x0001",

  		




  
  333
  
    
		"net.enc.out.ipsec_filter_mask" => "0x0001",

  		




  
  334
  
    
		"net.enc.in.ipsec_bpf_mask"     => "0x0002",

  		




  
  335
  
    
		"net.enc.in.ipsec_filter_mask"  => "0x0002"

  		




  
  336
  
    
	),

  		




  
  337
  
    
	'if_ipsec' => array(

  		




  
  338
  
    
		"net.inet.ipsec.filtertunnel"   => "0x0001",

  		




  
  339
  
    
		"net.inet6.ipsec6.filtertunnel" => "0x0001",

  		




  
  340
  
    
		"net.enc.out.ipsec_bpf_mask"    => "0x0000",

  		




  
  341
  
    
		"net.enc.out.ipsec_filter_mask" => "0x0000",

  		




  
  342
  
    
		"net.enc.in.ipsec_bpf_mask"     => "0x0000",

  		




  
  343
  
    
		"net.enc.in.ipsec_filter_mask"  => "0x0000"

  		




  
  344
  
    
	),

  		




  
  345
  
    
);

  		




  
  346
  
    

  		




  325
  347
  
    
?>

  		












  

    
      src/etc/inc/system.inc
    
  





  102
  102
  
    
}

  		




  103
  103
  
    

  		




  104
  104
  
    
function activate_sysctls() {

  		




  105
  
  
    
	global $config, $g, $sysctls;

  		




  
  105
  
    
	global $config, $g, $sysctls, $ipsec_filter_sysctl;

  		




  
  106
  
    

  		




  
  107
  
    
	if (!is_array($sysctls)) {

  		




  
  108
  
    
		$sysctls = array();

  		




  
  109
  
    
	}

  		




  
  110
  
    

  		




  
  111
  
    
	$ipsec_filtermode = empty($config['ipsec']['filtermode']) ? 'enc' : $config['ipsec']['filtermode'];

  		




  
  112
  
    
	$sysctls = array_merge($sysctls, $ipsec_filter_sysctl[$ipsec_filtermode]);

  		




  106
  113
  
    

  		




  107
  114
  
    
	if (is_array($config['sysctl']) && is_array($config['sysctl']['item'])) {

  		




  108
  115
  
    
		foreach ($config['sysctl']['item'] as $tunable) {

  		












  

    
      src/usr/local/www/vpn_ipsec_settings.php
    
  





  35
  35
  
    
require_once("ipsec.inc");

  		




  36
  36
  
    
require_once("vpn.inc");

  		




  37
  37
  
    

  		




  
  38
  
    
global $ipsec_filtermodes;

  		




  
  39
  
    

  		




  38
  40
  
    
$pconfig['logging'] = ipsec_get_loglevels();

  		




  39
  41
  
    
$pconfig['unityplugin'] = isset($config['ipsec']['unityplugin']);

  		




  40
  42
  
    
$pconfig['strictcrlpolicy'] = isset($config['ipsec']['strictcrlpolicy']);

  		




  ......




  47
  49
  
    
$pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']);

  		




  48
  50
  
    
$pconfig['maxmss'] = $config['system']['maxmss'];

  		




  49
  51
  
    
$pconfig['uniqueids'] = $config['ipsec']['uniqueids'];

  		




  
  52
  
    
$pconfig['filtermode'] = $config['ipsec']['filtermode'];

  		




  50
  53
  
    
$pconfig['ipsecbypass'] = isset($config['ipsec']['ipsecbypass']);

  		




  51
  54
  
    
$pconfig['bypassrules'] = $config['ipsec']['bypassrules'];

  		




  52
  55
  
    
$pconfig['port'] = $config['ipsec']['port'];

  		




  ......




  238
  241
  
    
			unset($config['ipsec']['uniqueids']);

  		




  239
  242
  
    
		}

  		




  240
  243
  
    

  		




  
  244
  
    
		if (!empty($_POST['filtermode'])) {

  		




  
  245
  
    
			$config['ipsec']['filtermode'] = $_POST['filtermode'];

  		




  
  246
  
    
		} else if (isset($config['ipsec']['filtermode'])) {

  		




  
  247
  
    
			unset($config['ipsec']['filtermode']);

  		




  
  248
  
    
		}

  		




  
  249
  
    

  		




  241
  250
  
    
		if ($_POST['maxmss_enable'] == "yes") {

  		




  242
  251
  
    
			$config['system']['maxmss_enable'] = true;

  		




  243
  252
  
    
			$config['system']['maxmss'] = $_POST['maxmss'];

  		




  ......




  277
  286
  
    
		$retval |= filter_configure();

  		




  278
  287
  
    

  		




  279
  288
  
    
		ipsec_configure($needsrestart);

  		




  
  289
  
    
		system_setup_sysctl();

  		




  
  290
  
    
		clear_subsystem_dirty('sysctl');

  		




  280
  291
  
    
	}

  		




  281
  292
  
    

  		




  282
  293
  
    
	// The logic value sent by $_POST for autoexcludelanaddress is opposite to

  		




  ......




  370
  381
  
    
	'<b>', '</b>'

  		




  371
  382
  
    
);

  		




  372
  383
  
    

  		




  
  384
  
    
$section->addInput(new Form_Select(

  		




  
  385
  
    
	'filtermode',

  		




  
  386
  
    
	'IPsec Filter Mode',

  		




  
  387
  
    
	$pconfig['filtermode'],

  		




  
  388
  
    
	$ipsec_filtermodes

  		




  
  389
  
    
))->setHelp(

  		




  
  390
  
    
	'Experimental. Controls how the firewall will filter IPsec traffic. By default, rules on ' .

  		




  
  391
  
    
	'the IPsec tab filter all IPsec traffic, including both tunnel mode and VTI mode. %3$s' .

  		




  
  392
  
    
	'This is limited in that it does not allow for filtering on assigned VTI interfaces, and it does not ' .

  		




  
  393
  
    
	'support features such as NAT rules and reply-to for return routing. ' .

  		




  
  394
  
    
	'When set to filter on assigned VTI interfaces, %1$sall tunnel mode traffic is blocked%2$s. ' .

  		




  
  395
  
    
	'Do not set this option unless %1$sall%2$s IPsec tunnels are using VTI.',

  		




  
  396
  
    
	'<b>', '</b>', '<br />'

  		




  
  397
  
    
);

  		




  
  398
  
    

  		




  373
  399
  
    
$section->addInput(new Form_Checkbox(

  		




  374
  400
  
    
	'compression',

  		




  375
  401
  
    
	'IP Compression',

  		















  
    (1-1/1)